Enabling Query Data Masking

Query Masking is a configurable feature that can mask PII and /or Sensitive field used in PS Queries. Only authorized users have access to view or run a PS Query that uses PII/sensitive data.

When a query is run, the system checks:

• If the Query Masking feature is enabled in the system.

• If the fields used in the query are identified as Personally Identifiable Information (PII) or Sensitive in the Data Privacy Framework.

• If the current user is authorized to view the PII and Sensitive fields.

You can enable the query masking feature using System Settings Page. If the Query Masking feature is not enabled, then there is no change in the PS Query behavior.

This does not impact or change the Query Security requirements for a user to access a PS Query.

In a query, a PII and/or sensitive field can be part of the query SELECT, WHERE or ORDER BY clause. For an unauthorized user:

• If a PII and/or sensitive field is in the SELECT statement of the PS Query, then the PII/sensitive column output is masked.

• If a PII and/or sensitive field is in the WHERE or ORDER BY clause, then PS Query stops the query process and does NOT return any output.

Use the Authorized Roles page (EODP_RRF_MNT_FL) to identify PeopleSoft Roles and define access to PII and/or sensitive fields.

Navigation:

Enterprise Components > Data Privacy Framework > Query Masking > Query Masking Authorized Roles

This example illustrates the fields and controls on the Authorized Roles page.

To add a role, click the Add button.

This example illustrates the Authorized Roles page when you click the Add button.

To enter further details, select the role and click Add.

This example illustrates the Authorized Roles page (EODP_RRF_MNT_FL) to enter more details in a HCM database.

For more information, about PS Query behavior, see Query Masking Examples .

Use the Synchronize Data page (EODP_QRYMSK_RUN_FL) to synchronize data privacy mappings in Data Privacy Framework with the Query system and authorized roles and their access to PII and/or sensitive fields.

Navigation:

Enterprise Components > Data Privacy Framework > Query Masking > Run Query Masking Data Sync > Synchronize Data

This example illustrates the Synchronize Data page.

System Setting

Field or Control	Description
Query Masking Status	Displays the query masking system status. For more information about enabling or disabling the query masking functionality, see System Settings Page.

Synchronize Data Privacy Settings

Field or Control	Description
Refresh Type	Select to determine the synchronization method. Options are: Full: Select to synchronize all PII and/or sensitive fields in the Data Privacy Framework and Authorized Roles data with the Query system. Incremental: Select to synchronize the changes in the Data Privacy Framework and Authorized Roles data with the Query system.
Run Type	Select to set the process run schedule. Options include: Run Now: Select to run the process immediately. Schedule: Select to run the process at a specified date and time or based on a defined recurrence.
Run Option	Select an option: One Time: Select this option run the sync process once, at the specified start date and time. Recurrence: Select this option to define a recurrence for the sync process. Note: This field is available only if you select Schedule as the Run Type.
Process Recurrence ID	Select a Recurrence ID. Note: This field is only available if you select Recurrences as the Run Option. Recurrence ID’s are defined in the Process Scheduler.
Start Date and Start Time	Specify the start date and time for the sync process. Note: These fields are only available if you select One Time as the Run Option.

Queued Processes

This section lists the process runs that are scheduled with the date and time. A request can be cancelled.

Note: PeopleSoft recommends that you schedule this sync process during low system usage hours. This is because the process updates internal tables and may sometimes result in data sync problems due to online transactions.

Use the Exclude Fields page (EODP_QMSK_EXCLU_FL) to identify the fields to be excluded from the Data Sync process.

Navigation:

Enterprise Components > Data Privacy Framework > Query Masking > Run Query Masking Data Sync > Exclude Fields

This example illustrates the Exclude Fields page.

Use the System Settings page (EODP_QRYSWITCH_FL) to enable or disable the Query Masking feature.

Navigation:

Enterprise Components > Data Privacy Framework > Query Masking > Query Masking System Settings

This example illustrates the fields and controls on the System Settings page.

Use the Query Masking Utility page (EODP_QRMSK_UTILITY) generate a list of users who have access to PII/sensitive data.

Navigation:

Enterprise Components > Data Privacy Framework > Query Masking > Query Masking Utility

This example illustrates the fields and controls on the Query Masking Utility page.

Report by Users

Report by User Access

Report by Record

This example illustrates the Report by Record Field.

Field or Control	Description
Authorized	This column indicates whether the user has access to the record and field combination. Options include: Authorized: User is authorized by Role Authorization configuration to view PII/sensitive data. Not Authorized: User is not authorized by Role Authorization configuration to view PII/sensitive data. Un-Authorized: Role Authorization is not configured for the User and/or Record fields.

This section discusses a few examples to describe Query Masking behavior.

Example 1 (FSCM)

Consider three FSCM users: User A, User B, and User C, and the roles assigned to each:

User A (VP1)	User B (SVP1)	User C (FVP1)
Administrator	Administrator	Treasurer
Bank Manager	System Administrator	Bank Manager

The Role Authorization configuration for Administer is:

This example illustrates the Authorized Roles setup for FSCM example 1.

User A, User B and User C run this query.

This example illustrates a Query SQL.

The PS Query output for User A and B is:

Phone and Ext (extension) are defined as “Authorized” for the Administrator role. Therefore, FSCM User A and B can view those values in the output.

The PS Query output for User C is:

User C does not have the Administrator role, therefore the Phone and Ext (extension) column values are masked.

Note: The Phone and Ext (extension) column values are masked as these fields are not defined as “Authorized” in the role authorization setup for the Treasurer and Bank Manager roles.

Example 2 (HCM)

Consider User A, User B, and User C run this query on a HCM database:

User A	User B	User C
HR Administrator	HR Administrator	Payroll Administrator
Payroll Administrator	Benefits Administrator	Benefits Administrator

The Authorized Role page is configured:

This example illustrates the Authorized Roles page.

Query

This PS Query uses a PII and/or sensitive field ETHNIC_GRP_CD in the WHERE clause.

User A, User B and User C are not assigned to roles that authorizes access the ETHNIC_GRP_CD field. Unlike the first query, PS Query stops the query and returns an error stating ‘ You have insufficient access to retrieve this data’.

This PS Query behavior protects PII/sensitive information.

Example 3 (HCM)

Consider the same HCM users from the previous example.

In this example, for the HR Administrator role, the Role Authorization configuration is:

Authorized Role configuration for HR Administrator role.

The PERSON.BIRTHCOUNTRY has an access code “Not Authorized”. This specification restricts all users with HR Administrator role from accessing the record field information.

Note: All other users who do not have the HR Administrator role can access the information.

When User A, User B and User C run the query, User A and User B do not have access to PERSON.BIRTHCOUNTRY field.

Query Output for User A and User B

However, User C does not have the HR Administrator role, and can view the Birth Country.

Query Output for User C

Note: PeopleSoft recommends that all users and their associated roles are reviewed in detail before setting a “Not Authorized” access.

Example 4 (HCM Subrecord Fields Masking)

Consider the same users from the previous HCM examples.

In this example, the Maintain Data Privacy Settings page is configured for HR_I9_PERSON:

Maintain Data Privacy Settings for HR_I9_PERSON

If Role Authorization is not configured, then because the ADDRESS1 field in both the ADDRESSES record and HR_I9_PERSON are from the ADDRESS_SBR sub-record, the ADDRESS1 field from both the records are masked.

This Role Authorization configuration for the HR Administrator role allows Users A and B to see the ADDRESS1 field from the ADDRESSES record:

Role Authorization configuration for the HR Administrator role:

Query:

When User A, User B, and User C run the query, User A and User B have access to the Address1 field.

Example 4 Results User A and User B

Example 4 Results User C